A malware outbreak has affected several Amazon EC2 instances. A key indicator is outbound traffic on TCP port 2905 to internet-based command-and-control hosts. A network ACL rule has been deployed to deny this outbound traffic at the subnet level. The security engineer must identify which EC2 instances are attempting connections on TCP port 2905. Which option will identify the affected instances with the least operational effort?

Enabling VPC Flow Logs configured to capture rejected traffic is the most efficient solution. When the Network ACL denies outbound traffic on TCP port 2905, these attempts are recorded as REJECT actions in the flow logs. Filtering these logs for the specific destination port (2905) will directly identify the source EC2 instances attempting the connections. Creating a Network Access Scope in Network Access Analyzer helps understand potential network paths but doesn't show actual denied traffic. GuardDuty and Detective are powerful for threat detection and investigation, but GuardDuty's default findings might not specifically flag outbound port 2905 attempts as a high-severity incident without custom configuration, and Detective would then be used for analysis, adding more steps than directly querying flow logs. Deploying AWS Network Firewall is an effective prevention and logging tool, but it requires deployment and configuration, which is more operational effort than simply enabling and querying existing VPC Flow Logs for a historical event.